Slashdot Mirror
ChoicePoint -- What We Learned from Our Screw-up
xpangler points out an article in Baseline magazine in which "ChoicePoint's lead privacy & compliance executives talks about the 'more than 30' new practices and procedures the company has put in place since it mistakenly sold private data on 163,000 people to Nigerian criminals last year."
Never trust anyone who says things like "Greetings!" and "Honorable", and who CAPITALIZES in very ODD places.
Dark Reflection
Perhaps I am too cynical, but when I see this:
Carol DiBattiste, ChoicePoint's chief credentialing, compliance and privacy officer, says the company has taken numerous steps in the past year to make sure such a breach never happens again.
I cannot help but think they actually mean:
Carol DiBattiste, ChoicePoint's chief credentialing, compliance and privacy officer, says the company has taken numerous steps in the past year to make sure such a breach is never made public again.
Really, the ONLY consequence a company like this suffers from a breach is negative publicity and maybe a token fine. Even bad publicity is not really a problem for them since the people they hurt have no say in whether or not to do business with them.
When that is the case, I'll bet it much easier to clamp down on leaks and not reveal breaches to the public/government than prevent them.
Finkployd
ChoicePoint is an aggregator. As much as 20% of their data could be inaccurate. Employers (for instance) make decisions based on ChoicePoint data, even though ChoicePoint "suggests" that they independently verify the accuracy of any negative reports. (Of course, it may work the other way also: 20% inaccuracy suggests that ChoicePoint will give subscribers false positive data, too.) Is this important? Well, Baseline Magazine wrote a nice article on this last year, http://www.baselinemag.com/article2/0,1540,1825320 ,00.asp7 ,00.asp
http://www.baselinemag.com/article2/0,1540,182528
and I was really impressed with the fact that a Home Depot employee spent a week in jail for crimes he did not commit.
Security is only half of it; Accuracy is the other half.
"The mind works quicker than you think!"
Sorry, the article says Frye's, not Home Depot...I should have double-checkd before writing.
"The mind works quicker than you think!"
Slashdot Burying Stories About Slashdot Media Owned
To who? ECHELON?
Oh. NOW. That would have been my first idea. Sensitive data? Encrypt it!
That's why I don't work in network security.
What repercussions? Did they lose business? Sure they got hit with a 10 million dollar fine but look at their financial statements, that is barely a drop in the bucket for them.
It was a total of $15 million, plus another $4 million in other obligations imposed by the FTC (like third party auditing). Insurance covered $11 million of the $19 million, but Choicepoint had to pony up $8 million of their own money. If you look at their financial statments, you'll see that it's no slap on the wrist - it represented half of their cash. In terms of yearly income, it's about 7% of what the company makes. Plus, I suspect that their insurer will either raise their liability insurance rates or drop them altogether.
I'd say that the penalty was fair. It's not necessary to drive the company out of business - just necessary to give them a sting so that they don't do it again.
-h-
I don't think anything they could have done or said would make any difference in my opinion about them.
include $sig;
1;
I have used Choice Point products at my last job. Following their little... ummm... mishap they changed my username (which they assign) from the first latter of my first name followed by my last name to random assortment of character. Progress indeed.
When are they going to talk about their "mistake" in 2000 when they helped Bush steal the election in Florida by illegally removing blacks from the voting rolls? Or has everyone forgotten about that by now? It'd sure be nice to see some of these traitors to our country get their Constitutionally mandated punishment, vs. being interviewed in magazines.
Americans need an ammendment to their Constitution that guarantees them the Right To Privacy. Then, assumiung a Congress that actually follows the Constitution can be elected, in conjunction with the Right To Privacy there should be a law that prohibits the use or sale of my personal data without my prior consent. Better: it should be against the law to even collect and store that information in any database where the consumer - citizen, if you will - doesn't have the ability to "SQL DELETE FROM * WHERE NAME = ME".
" ... since it mistakenly sold private data on 163,000 people to Nigerian criminals last year."
This is a joke, right ?
The Dutch will inherit the earth. If not, we'll settle for a bit of ocean. Beta delenda est!
Ms. DiBattiste doesn't have a very good rep as a privacy advocate.
how do you mistakenl sell personal data to nigerian criminals you dont even bother to find out who your customer is?
Most laws, in the USA anyway, come about because of someone else's failure.
Eventually, someone will be seriously hurt by data loss/theft/whatever.
Evenually, the data broker will be forced to pay with blood, money, or time in jail.
Most likely, someone with substantial assets will get bitten bad and still have what it takes to sue the broker out of business...then the legislature AKA lawyers will get involved.
Good judgement comes from experience, and experience comes from bad judgement.
- W. Wriston, former Citibank CEO
I had this happen to me. I was supposed to start a job on monday the day after thanksgiving break.
Wednesday I get a call from the head of HR wanting to know about my felony charge in Rochester, NY. I'd never been to Rochester and had no idea what she was talking about.
In this case, the company doing the background check had not even bothered to verify my social security number and such. Just pulled up the name, which isn't all that unique.
Fortunately the HR head understood that these things are often wrong and verified the information. But still... this can be a real problem.